Hackers Steal Thousands of Wyndham Credit Card Numbers

Hackers broke into a computer at Wyndham Hotels and Resorts last July and stole tens of thousands of customer credit card numbers, the hotel chain warns.

The break-in occurred at a property belonging to a Wyndham franchisee, but that computer was linked to other company systems. “That intrusion enabled a hacker to use the company server to search for customer information located at other franchised and managed property sites,” the company said in a statement disclosing the breach.

The data was then uploaded to a Web site during July and August of 2008, Wyndham said. The company estimates that 41 Wyndham hotels and resorts were affected by the breach before it was discovered by the company’s information security team in mid-September. The incident did not affect other Wyndham properties such as Days Inn, Ramada or Super 8.

Wyndham has not said how many guests were affected by the theft, but it may have affected as many as 21,000 customers in Florida according to that state’s attorney general. Wyndham’s representatives did not return calls seeking comment on the breach.

The criminals were able to get guest names, credit card numbers and expiration dates as well as data from the card’s magnetic stripe, Wyndham said.

That magnetic stripe information, sometimes called a card verification value (CVV) code, is critical if the thieves want to make fake credit cards, according to Avivah Litan, an analyst with Gartner Research.

“That’s the hot information,” she said. “You can sell that information for much more on the black market.” CVV codes were also taken in the high-profile Heartland Payment Systems and The TJX Companies credit card thefts.

When fraud is perpetrated using fake cards that include the CVV codes, the banks are responsible for the charges; when the fraudsters have only the card numbers and expiration dates — the information used in online transactions for example — then the retailer is responsible for the charges. “The banking industry is all up in arms whenever bank stripe data is stolen,” Litan said.

After an eight-week investigation, Wyndham notified the U.S. Secret Service, which investigates financial crimes, as well as credit card companies. Customers were made aware of the breach in December. Last week, it posted more details on the incident to its Web site.